Ledger has issued a statement following reports from customers of loss of funds and tampered devices, calling it one the most “sophisticated attacks” the digital asset industry has experienced.
The hardware manufacturer said Thursday that a “highly organized criminal group” bought Ledger devices and installed implants that could read users’ seedphrases before then putting them back into the supply chain via resellers.
Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis.
The company then said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
It isn’t clear how much money has been lost from the tampered devices but blockchain investigator Specter said $86 million had been drained. Ledger did not respond to Bitcoin Magazine’s written questions.
“[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets,” Ledger said in a Thursday statement.
“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”
The company said that in its “largest investigation to date” it sent employees to other markets — including Europe — to make sure other supply chains hadn’t been targeted.
It said that screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong have suspended their sales.
Ledger added that it was working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”
It isn’t clear how many customers had been targeted from Ledger’s statement.
The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
There have also been a number of data breaches this year, with scammers targeting Ledger to get customer information via the company’s payment processor Global-e.